How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
asked Jan 12, 2017 at 22:52
Add a comment
|
2 Answers
Basically you just need to force a user on that network to disassociate with the wifi, then when it reconnects, the ssid will be transmitted in plain text.
Check out this guide.
answered Jan 12, 2017 at 23:07
-
1Deauth attacks will not work all the time, but this is the right way to probe SSIDs.– user28177Jan 13, 2017 at 9:49
The baics of wifi (802.11 IEEE standard) states that there are 3 connection stages.
- Not authenticated or associated
- Authenticated but not yet associated
- Authenticated and associated
To move from the 1st stage to the 2nd, the STA (Station, any device/supplicant) sends a probe request with an SSID that is has saved in it's lists of already connected wireless networks, it is this exact packet that we want to capture.
To find a network name of a hidden ssid you need to send a STA from the 3rd stage of connection to the very first, to capture the probe request and read the SSID it's trying to connect.
This is done sending a disassociation management package to the AP spoofing the STA, and then sniffing the probe request when it wants to connect again.
